Works across NAT
The agents build their own encrypted WireGuard tunnel. The server behind the router calls out, so there is no port forwarding and no VPN to maintain.
MariaDB replication, managed
ZeroBehind sets up, monitors and switches MariaDB's built-in replication between two servers, even when one of them sits behind a home or office router. One agent per server. No cluster to learn.
Runs on your own servers. Your data travels directly between them through an encrypted tunnel.
Measured in November 2026 on our own pair: a public server and a home server behind NAT, under continuous writes, verified row by row and by table checksums. Your numbers depend on your data and your link.
What you get
The agents build their own encrypted WireGuard tunnel. The server behind the router calls out, so there is no port forwarding and no VPN to maintain.
17 checks of your MariaDB configuration, with one-click fixes. Pair the servers with a one-time code, review the plan, start the copy.
The dashboard counts how many transactions the replica is missing, from GTID positions on both sides, and tells you what a failure right now would cost.
For maintenance or a move: the master pauses writes for a moment, the replica applies everything and takes over, and the old master follows it. Nothing is lost.
When the master is gone, the replica is promoted on your confirmation and says how many transactions may not have arrived. When the old master returns, it blocks its own writes.
A web console and a signed, notarized macOS app show all your pairs at a glance. A single command gives monitoring an exit code. English, Polish and Italian.
How it works
One binary and a systemd service. It checks your MariaDB and proposes the settings replication needs.
Each agent has its own certificate authority. Pairing pins the other side's identity, so nobody can sit in the middle.
The replica receives a consistent snapshot and then follows the master with MariaDB's own GTID replication. Its previous data is kept aside, never deleted.
ZeroBehind does not replace MariaDB replication. It drives it: your data stays in standard MariaDB format on both servers.
Safety
Replication tools fail in the corners: a job that writes on the replica, an agent killed in the middle of a switch, a server that comes back after it was replaced. We test those corners on every release, on real MariaDB servers, under load.
And when ZeroBehind cannot be sure, it stops and tells you why. A short pause is better than two masters.
Questions
No. It is one master and one replica using MariaDB's own asynchronous GTID replication, with the setup, monitoring and role switching done for you. If you need several writable nodes, you need a different tool.
No. The agents connect your two servers to each other directly, through an encrypted tunnel. The console talks to the agents the same way.
We run and test it with MariaDB 10.11 and 11.8 on Ubuntu 24.04 and 26.04. Tell us what you use in the form below and we will say honestly whether it is covered.
Not yet. MariaDB comes first. If you run MySQL, say so in the form: it helps us decide what to build next.
Not by themselves yet. After a role switch you point your applications to the new master. Automatic address handover is on the roadmap.
Pricing will be published with the public release. Early-access users hear first.
Early access
ZeroBehind is in early access. Leave your details and we will write back with access and, as soon as it is public, pricing.
We use what you send only to answer you. No newsletter, no sharing. See the privacy notice.